Password Plaintext Storage - Revision history

Jvargas: /* Risk Factors */

2019-05-19T16:39:41Z

‎Risk Factors

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T21:49:53Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

Imifos: fixes classification

2015-12-01T11:51:43Z

fixes classification

KirstenS at 13:29, 27 February 2009

2009-02-27T13:29:07Z

KirstenS at 13:45, 19 February 2009

2009-02-19T13:45:01Z

KirstenS at 20:39, 4 November 2008

2008-11-04T20:39:36Z

KirstenS at 22:47, 28 September 2008

2008-09-28T22:47:30Z

Wichers at 14:43, 31 October 2006

2006-10-31T14:43:39Z

Weilin Zhong: Plaintext Storage moved to Password Plaintext Storage: Make it more clear.

2006-07-21T18:38:50Z

Plaintext Storage moved to Password Plaintext Storage: Make it more clear.

Weilin Zhong at 16:46, 19 July 2006

2006-07-19T16:46:35Z

@@ Line 18: / Line 18: @@
 ==Risk Factors==
-TBD
+Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource.
@@ Line 63: / Line 63: @@
 [[Category:FIXME|add links
 In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 Availability Vulnerability
 Authorization Vulnerability
 Authentication Vulnerability
 Concurrency Vulnerability
 Configuration Vulnerability
 Cryptographic Vulnerability
 Encoding Vulnerability
 Error Handling Vulnerability
 Input Validation Vulnerability
 Logging and Auditing Vulnerability
 Session Management Vulnerability]]
 __NOTOC__
 [[Category:OWASP ASDR Project]]

@@ Line 93: / Line 93: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Sensitive Data Protection Vulnerability]]
-[[Category:OWASP_Java_Project]]
+[[Category:Java]]
 [[Category:Code Snippet]]
 [[Category:Password Management Vulnerability]]
 [[Category:Vulnerability]]

@@ Line 93: / Line 93: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Sensitive Data Protection Vulnerability]]
-[[Category:Java]]
+[[Category:OWASP_Java_Project]]
 [[Category:Code Snippet]]
 [[Category:Password Management Vulnerability]]
 [[Category:Vulnerability]]

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
 [[ASDR Table of Contents]]
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password.
@@ Line 11: / Line 19: @@
 Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource. Developers sometimes believe that they cannot defend the application from someone who has access to the configuration, but this attitude makes an attacker's job easier. Good password management guidelines require that a password never be stored in plaintext.
 ==Examples ==
 The following code reads a password from a properties file and uses the password to connect to a database.
@@ Line 25: / Line 40: @@
 </pre>
-==Related Attacks==
+==Related [[Attacks]]==
-==Related Vulnerabilities==
+Availability Vulnerability
-==Related Countermeasures==
+Authorization Vulnerability
-[[Password Management Countermeasure]]
+Authentication Vulnerability
-==Categories==
+Concurrency Vulnerability
 [[Category:Sensitive Data Protection Vulnerability]]
 [[Category:Java]]
 [[Category:Code Snippet]]
 [[Category:Password Management Vulnerability]]
 {{Template:Fortify}}

← Older revision	Revision as of 18:38, 21 July 2006
(No difference)

← Older revision		Revision as of 16:46, 19 July 2006
Line 1:		Line 1:
		+	{{Template:Vulnerability}}
	{{Template:Fortify}}		{{Template:Fortify}}
−	~~{{Template:Vulnerability}}~~

	==Abstract==		==Abstract==